Certificates are public records
Every TLS certificate is logged in public. That makes a new certificate one of the earliest signs of a new site.
whois.is team3 min read
Certificate Transparency logs record every certificate a trusted authority issues. Anyone can read them, including us.
When a certificate's issuer changes, or it suddenly covers new names, the site behind it has usually changed too. We keep the old certificate next to the new one so you can see exactly what moved.